Latest / Identity at the Center / #195 - Fully Merged Identity Security with Gabe Avner

Transcript

#195 - Fully Merged Identity Security with Gabe Avner · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:26
sender podcast I'm Jeff and that's Jim.
0:28
Hey Jim hey Jeff, how are you? Oh, not so bad yourself, I'm
0:33
doing good. And I've been having some
0:34
thoughts, you know, in our last episode kind of me.
0:38
We're talking about is 2023 the year, the password dies.
0:42
And that I think I made a comment something, like well
0:45
maybe we should say is this, the decade that pastors died and I
0:51
got the thinking about it. It's like, yeah, this cast
0:56
really you know covers the gamut of identity management identity
1:01
access management and I also think we have to be careful when
1:05
we talk about things because when I made a statement like
1:07
that it's almost like giving permission or it's okay to let
1:12
the password kind of devolve and I started to think about okay if
1:18
a breach occurs because the password password is kind of
1:22
pointed to as the reason why Your company's on the front page
1:26
of the New York Times, whose fault, is that going to be?
1:30
And I kind of thought about it. From the perspective of, you
1:35
know, this is always kind of been one of my feelings, whether
1:39
it was in it or in information security and you're talking to
1:45
leadership and you're trying to get funds allocated to do
1:49
something right to kill the password, is going to cost some
1:51
money. You're gonna have to implement
1:53
some technology to To get rid of the password or you're going to
1:56
have to have a project at least to get rid of the password.
2:00
And so you're going to have to communicate to business
2:03
leadership of why they should take some money.
2:05
And instead of returning it to shareholders, they should spend
2:08
it on password list technology. And I think at the very least,
2:15
we've got to make them understand why the password has
2:20
to go away and it's, you know, it's at the center of so many of
2:24
these These breaches as becoming more, and more of a, of a part
2:28
of that kind of threat landscape.
2:31
You look at some of the, the breaches that have taken place
2:34
over the past year and the passwords were at the center of
2:39
those. And so, you know, kind of the
2:41
perspective that I'm coming back with is just, you know, I think
2:45
I oversaw from by saying I'll we, you know, just a decade.
2:48
The password guys, maybe that is what truly happens.
2:52
But as I am practitioners. It's our responsibility to
2:57
communicate up to our leadership, to make them
3:01
understand why. This is something that should
3:04
happen. Now, happened this year happen,
3:07
as soon as possible and why it's worth the investment for your
3:10
thoughts. I have, I have a few thoughts,
3:14
alright? So, the first thing is, I think
3:15
it's realistic to say that this is the decade, rather than
3:20
trying to try to shoehorn in a seismic change.
3:23
Like this, I mean, what we're talking about is password,
3:25
right? It is literally the only lock
3:28
on, I don't know, 90% of the resources that are out there.
3:32
It's usually just an ID and password may be.
3:34
That you have some areas that do MFA or have some other fancy
3:37
types of authentication. But you're talking about
3:40
changing the way. Authentication is done for
3:44
billions upon billions of different things that are out
3:47
there. That is not something that
3:49
changes within a year, two years, five years even, and then
3:52
you marry that up against, you know, Enterprises and budget
3:55
cycles and how long it takes to get things done.
3:58
I mean, you think about anybody who's been trying to get like
4:00
IGA or privileged access management tools into their into
4:04
their environment. If you're any sort of decent
4:06
size of organization, it usually takes even just a couple years
4:09
to get to the point where it's like okay yeah, we're ready to
4:11
make the That and then even those are a couple years out and
4:14
you're talking about changing, literally, the way people
4:16
operate. It's like that.
4:20
I think it's a decade-long transition.
4:22
It's like, you know, going from internal combustion, two v's.
4:25
It's taken decades to get their steam engine to, you know, other
4:29
things, right? These are seismic shifts in the
4:33
identity space and you're talking about literally.
4:35
The one thing that is probably the most prevalent security
4:40
option in the world. A password.
4:43
It's going to take time to change, all right, but I need
4:46
time to be the right. Like it may not even be the
4:48
right solution to go to password list.
4:50
I mean, Martin kind of brought up Mainframe in the last, our
4:54
last episode, we've been trying to kill the Mainframe for 50 or
4:56
60 years. It seems like they're still
4:58
around and they're in hot demand because you know that Lisa skill
5:02
set for it because it is so rare.
5:05
Password was to me is a arrow in the quiver of identity.
5:09
It does not mean it needs to be the only solution for an
5:13
organization. We talk about risk and like okay
5:16
well if we're going to show, you know, the the secret sauce for
5:19
how we make Kentucky Fried Chicken.
5:20
Of course, you probably want to have a little bit more than that
5:22
a password probably you know the recipe needs to be under lock
5:25
and key but if it's the menu to go you know to go to your
5:28
cafeteria who cares, right. Maybe a password alone is good
5:32
enough. Maybe I'm just not even having a
5:33
passwords line so I think Be a risk based discussion around it.
5:37
I just from a realistic standpoint I just I think I
5:40
think we're talking like a decade transition to really even
5:43
see it make make an impact or make waves.
5:46
We're like that's the way the majority of people are
5:48
authenticated. He is there some sort of
5:50
password was approach. I just don't think it will
5:52
happen as quick as we want to. I think what has to happen
5:55
unfortunately. Is you have to have that
5:58
catastrophic event, That shows that passwords are at the level
6:07
of like, covid there at the level of 9/11 throughout the
6:11
level of World War Two, that you say, this is life-altering.
6:16
We need to change this now and there's no excuse for it and
6:24
maybe it's not maybe, maybe if devolving away from the password
6:28
is going to be fine. Or maybe some kind of attack
6:34
happens based on the password. That's just social catastrophic
6:39
that you know it makes everyone realizes the reason I used to
6:44
covid as an example, think about it they everything shut down.
6:47
Now all these companies have to scramble to enable remote
6:52
Workforce had to scramble to you know, adopt MFA.
6:57
And it happened, it happened Maybe people had their hair on
7:02
fire and had to loot work. A lot of weekends to make it
7:05
happen but it did happen and it was because of this like
7:08
catastrophic event taking place, and I don't know if that's what
7:12
it's going to take to get the password list but kind of seems
7:15
like it to me. Yeah.
7:17
I mean, I get the point on the covid thing but I also see other
7:20
catastrophic events that keep occurring ransomware and other
7:24
things that they just keep happening and sure that one
7:28
company changes, maybe, or maybe there's a couple When the
7:31
industry that changes, I don't know.
7:34
I mean, I'm not gonna even try and say that I had the answer,
7:36
but I just feel like it is going to be a slow transition and it
7:42
will be driven by budgets more so than like an event that were
7:47
to take place. The events might be more
7:50
Tactical for a specific organization but I still think
7:53
the like the industry and business at large will slowly
7:57
transition over over 2. So that concept You know in the
8:01
future, okay? So let me write this up by going
8:04
back to my original point is that we as the I am
8:07
practitioners know where our risk lies within the
8:11
organization, we understand what the potential impact of somebody
8:15
getting hold of credentials based on the password breach.
8:20
And we need to be educating up the chain.
8:24
So people understand that I can make the I could make the
8:28
decision about the investment. With all the information.
8:32
Make sure that the leadership understands.
8:34
Here's our risk, here's the cost to address the risk and then
8:38
they can make the decision as the leaders of that business.
8:43
I'll even get that. That's my.
8:45
That's kind of the end of my point.
8:47
Yeah, I mean, everything's gonna be a risk based decision.
8:50
So you know money is not unlimited.
8:53
Resources aren't limited time people, Etc.
8:55
So you've got to pick and choose the battles, you know, this will
8:58
be a line item somewhere to say, okay.
9:00
Do we want to do? We want to dress password lists
9:02
or do we want to? I don't know, you know,
9:05
implements a multi-cloud, you know, security strategy or will
9:10
it be identity governance or will it be, you know, XYZ,
9:13
right? This is where the cisos get.
9:16
Get paid, the big bucks and they sit on the hot chairs to to try
9:20
and balance all those risks. Because if everything's on fire,
9:22
nothing's on fire. You have to try to prioritize
9:25
some of that work. So I'm with you II, wish I
9:28
would, I wish it would happen faster.
9:29
I think most in the space wish it would happen faster because
9:33
the idea is to become more secure but also, you know, it's
9:36
much more user-friendly. Who doesn't want that?
9:39
I think everyone wants it. They can real.
9:41
You know, the the realistic output though is it comes down
9:44
to money and time and those things aren't limited.
9:46
So you had to kind of pick and choose battles.
9:48
What do you think about the upcoming conferences that are on
9:51
those on the docket? We got Gardner I am Summit in
9:54
March, I Denver's in May and the European identity and Cloud.
10:00
In may, as well as the Cooper Nicole conference that we talked
10:04
about in the last episode. Yeah, some Heavy Hitters there.
10:08
I mean, I'm going to be biased as of right now because of
10:11
Gartner inviting us to come actually come to the conference
10:15
and bring our podcast up onto the stage, which is very
10:18
exciting news for us. So if you haven't heard Jim and
10:21
I are actually going to be at Gartner's.
10:22
I am Summit in March in Grapevine, Texas.
10:25
We will have some sort of session on a stage with garbage.
10:30
Our analysts and put them on the hot seat, maybe we still kind of
10:34
figure out what that show is going to look like, but the idea
10:36
is to bring so the flavor of this podcast and this discussion
10:40
format and and you know have a good time with it.
10:43
So looking forward to that. So I'm going to be biased and
10:45
say that right now, but obviously done a versus a great
10:48
conference. We know that European identity
10:50
Cloud conference in May and Berlin is also great one too,
10:55
but it's not from personal experience.
10:56
We don't know. Not for present.
10:57
I have not been out there yet, but I am trying to figure out
11:00
how We can make that happen at some point, either this year, or
11:04
in the future. Yeah, I wanted to mention, you
11:07
know, what you said about them, having us as speakers that
11:11
Gardener or facilitating a session to me that such a
11:15
fantastic opportunity. But it also put my personal
11:18
stamp of endorsement on that conference even if we weren't
11:21
doing this session is such a fantastic conference to learn
11:25
and to interact with your peers. Speaking of interacting with
11:30
peers, There's one thing I want to do Jeff is put together some
11:33
kind of meet up or something like that around the community,
11:38
that I think we're building here with the identity at the center
11:41
conference, our podcast to, you know, maybe get everybody
11:45
together, you know, for breakfast or something, just
11:48
meeting the breakfast Hall and, you know, take a table or to
11:51
push them together and, you know, just get to know some of
11:54
the people who listen to the podcast.
11:57
Wow, you're optimistic pushing a couple days ago.
11:58
I'm thinking like, maybe like two or three people might Out
12:00
for that. Well, I guess what that remains
12:03
to be seen by prove me wrong please.
12:05
I'll be great. Yeah no I mean if folks are
12:09
thinking about going to the conference or surely going to
12:11
conference reach out to Jeff and or myself on LinkedIn we love to
12:18
arrange something, some kind of meet up.
12:20
Yeah it's cool to have just conversations like just, you
12:24
know, we're humans just like everyone else.
12:26
And I think I think one of the things we'd like to do is
12:29
probably tap into our listening audience.
12:30
Audience and try to get some good questions that we can ask
12:33
the gardener folks. Well, we're on stage and maybe
12:36
put a little bit on the hot seat.
12:37
So I know we've been kind of been gracious, graciously given
12:40
some leeway on where and where, where and what we can go to, so
12:45
maybe we'll tap the audience for that.
12:46
So if you've got ideas or you've got burning questions, you'd
12:48
like to ask the Gartner analyst under the Jim and Jim and I and
12:51
Linkedin and we will pull that into our aren't to our quiver of
12:55
questions that we may pull out at the event itself.
13:00
We should probably get to what we're actually going to talk
13:03
about today. I know Jim, you read recently an
13:07
article on the awesome eyes website and we've invited the
13:11
author of that article. His name is Gabe avner, he's a
13:13
director of content and awesome eyes.
13:15
He wrote this blog post around called 2022.
13:19
Is the year that identity fully merged with security a
13:22
retrospective. It's a very long title but
13:24
welcome to the show game. Hey guys!
13:26
How's it going? It's going great, we're into the
13:29
new year, we've got new. Codes.
13:31
And I think one of the things that we like to find out the
13:33
first time we have folks on the show is really kind of learn
13:35
about their identity background and you've got a little of an
13:37
interesting one because I don't think you started here, but
13:39
maybe you can kind of share with the folks were listening.
13:41
How did you get into the identity space?
13:44
Is it something that that you chose or did it end up choosing
13:47
you? So I'd say I definitely chose
13:50
it. My background comes from
13:55
geopolitical analysis, as a security consultant intelligence
13:58
analyst guy. And then Transition from there
14:01
into journalism. And like, all good journalist, I
14:04
end up getting laid off because things closed down, because
14:07
there's, no, there's no real good money in it.
14:12
And at that point, I transitioned over to startups.
14:15
And my first startup was actually in a knapsack.
14:19
So, it was a company that dealt with open source security, and
14:25
that was totally new to me. And it was exciting because a
14:28
certain large credit. Agency had just gotten and
14:32
themselves in some hot water at the time.
14:34
So those players right about? And eventually when I moved on
14:38
from there, I wanted to find something that was a little more
14:41
deal with human issues and for me, identity is kind of that
14:46
really fascinating cross between You know, if the technical
14:52
management problem and the one hand, but it's also just
14:54
managing people and letting people work, you know, it's very
14:58
much just you know, there's a front-end back-end side of it
15:01
but just how do you let people be productive while still
15:05
maintaining security? And I think also I got into it
15:10
at a very interesting time when things started to change our
15:13
Villa B. You start to see kind of this
15:14
more I grow up, you know Colonial pipeline had happened
15:19
around the time that I got into it.
15:21
And I'll solar winds which I'm sure we'll get into at some
15:23
point. And those were interesting days
15:27
and I was kind of like when I was trying to decide is this
15:30
this kind of next Direction I want to get into and there's
15:33
just too much going on. So between kind of the news
15:35
value and Justice, as a writer to be able to write about those
15:39
things. Identity was was the place to be
15:43
You talk about the human side of identity and I think I think
15:46
that's something that doesn't get enough.
15:48
I do airtime is yeah, we always talk about like tools and
15:51
Technologies and you know, standards and all those things
15:54
are really important by the end of the day.
15:56
It's the human that actually has to use all this stuff and
15:59
interact. And we talked, you know, Jim and
16:00
I just had a, you know, back and forth on password list.
16:03
We're talking about the way humans interact with things, and
16:06
I think it's interesting to bring more of those viewpoints
16:08
in because if, if something's not usable, it's not going to be
16:12
successful. Or it's gonna have a really hard
16:14
time being successful. It's going to have kind of Brute
16:16
Force so I'm glad you bring that perspective to, you know, to the
16:19
conversation. Yeah, you know I think Security
16:22
in general is always a question of, you know, usability versus
16:25
how secure is it like if people can't use it, they're not going
16:30
to, they're not going to use it. And then all, you know, all the
16:35
best for your products and practices can just go out the
16:37
window because they're not using it for years.
16:42
I worked with journalists In the field doing, you know, kind of
16:45
their secure either often Iraq to Syria, they're protesting the
16:48
state's everywhere and you can be providing the best security
16:52
background for them, you know, and support.
16:54
But if they don't want to talk to you, if you're making system
16:56
to sold so difficult for them to interact with their just going
17:00
to ignore you, right? So you always have to find in my
17:04
opinion like a way to make it super easy for the users to
17:10
actually want to use while making sure you Oxygen, your job
17:13
as a security person. So that's that's where
17:15
identities for me. It just all seems you know if
17:18
you feel like I got into identity kind of post pandemic,
17:21
it was kind of like towards the end pandemic where everything or
17:25
have you know jump to Cloud. So like everything was already
17:28
identity identity identity credentials.
17:30
So for me it's just a fantastic time to get into it and now
17:34
you're with awesome eyes for folks who aren't familiar.
17:38
We've had gal disk and on from awesome eyes was episode 98 back
17:42
in. Of 21.
17:44
So it's been a couple years a year and a half or so for those
17:47
not familiar with awesome eyes. What's the you know?
17:49
30 seconds 60 second elevator ride sort of commercial for what
17:54
you guys do. So awesome eyes is a identity
17:58
threat detection and response platform so this is still a new
18:02
term. The Gartner is developing.
18:05
They have some interesting papers out there that you can
18:07
check out and get their perspective on it but it's
18:10
basically the idea of that You know, everybody knows that you
18:15
haven't, you needed, endpoint security, and the network
18:17
security, and the cloud security.
18:19
And now identity is at the center of security and it's time
18:24
for organization to actually have this the solutions that
18:26
they need or to have the visibility and control the see,
18:30
you know who's using, what who has access to what's, how are
18:32
they using that access? But also, how are their systems
18:37
being protected from active threats?
18:39
So it's not just a my doing pasture management.
18:42
It's a It s suspicious activity. Do I have a way to respond to it
18:46
as part of like you know the rest of my security stack and
18:49
the workflow? Like does it go to my splint,
18:51
does it go to my whatever itsm I'm using?
18:54
And optimize is going to help give you that visibility in the
18:57
control and the context across all the different Cloud systems
19:01
that you're using and on-prem to be able to figure out how to do
19:04
it. Gabe, let's, let's switch topics
19:07
a little bit. Talk about that blog.
19:09
And I want to know is this title click bait or is it is?
19:13
Is it something real? So you called it 2022 is the
19:17
year that identity fully merged with security retrospective.
19:21
So as I click bait or is there actually something special about
19:25
20 22 that, that was the reason that you wrote this article.
19:31
So I try to never do clickbait first off because I'm bad at it.
19:37
We could we could teach you. That's what we're all about
19:39
here. No, I just I've tried and tried
19:45
to do to get better quickly because it's good for four Clips
19:48
but I'm just bad at it. I did always want to use the
19:51
word a retrospective in a title so that one was like a little
19:55
bit of just wanting to do that but I think 2022 was actually a
20:01
very interesting year because kind of The Facts of the field
20:04
changed. I think you look at 2020 when
20:10
the solar wind attack happened and and it's Colonial pipeline
20:15
that year 2021, you started to have large identity-based
20:23
incidents going on. In 2021.
20:27
But at the time it was still stayed actors.
20:33
He was big enough. You know that there's always
20:35
this this issue and security of I'm going to get by because I'm
20:39
obscure like nobody knows me well enough, I'm not going to be
20:42
an interesting enough targets to be worth putting these you know,
20:46
practices in or having these tools in place and The
20:53
solarwinds attack was you know, reportedly nobelium apt as in
20:59
29, which is Russian hackers. Basically you know it was a very
21:06
skilled team and so a lot of organizations said, oh wow, that
21:09
was a big thing but they were very selective.
21:11
It was a front from a hacker perspective, is actually super
21:13
interesting in the way that they went.
21:16
You know, they had access to Basically everybody, you know,
21:20
government organizations University is your large
21:23
companies but they were very selective about who they
21:25
actually use that access to the front that they got from the
21:28
supply chain to actually go and breach.
21:31
But me, 2021, you can still kind of say, I'm not really going to
21:35
be likely to be a Target, because it's only going to be
21:38
the Super Elite hacking teams and going after strategic
21:41
targets. And that's not me, even if it
21:46
was, people were still going to say, you know, that's not me.
21:49
20:22 was the year of lapses and that's, you know, there was
21:55
there wasn't a lot of kind of joking about like is 20 is
21:57
lapses, kind of the democratization of identity
22:00
hacking because all of their hacks have basically kind of
22:04
been not super technical from like a, you know, they're not
22:09
going through and finding, you know, 02 bones, like they're
22:12
they're going in and like the they're sending, you know.
22:17
They're, they're like SMS by They're doing things to trick
22:21
the human element and they're explaining the identity part of
22:25
the, the threat surface. So 2022 for me was the year
22:31
that's organization organization.
22:33
Start to understand it's not enough to kind of hope to skate
22:38
by by, you know, not being a big enough Target script kiddies
22:42
basically, canals, Target me with a little bit of software,
22:45
you need to maybe pick up my MFA.
22:48
So they can annoy the hell out of my people.
22:52
And so they they just click approve and it's going to work
22:55
for them. So maybe I need to start taking
22:57
some more seriously. And I think that, you know, as
23:02
identity folks yourselves you've seen over the years and identity
23:06
started off, you know, there's always a security element to it
23:10
but it was very much kind of an ith are kind of, you know, side
23:14
of that the house right there was, I mean, you had to make
23:18
sure you getting the right. You know, provisioning to the
23:21
right people, but I don't think it was fully taken as a, as a
23:25
security discipline. I think that now that is, you
23:28
know, been proven by not just kind of the elite level of
23:34
hacking teams to you, nobody, but also by anybody who wants to
23:38
try, you know, identities. Now evolved into the kind of
23:44
Like I hate the militarization of cyber stuff but like it's
23:48
kind of the next next you know mud pit where everybody's going
23:51
to sling it out, you know. So it's Battlefield is the mud
23:55
pit. It's a place where people are
23:58
need to, you know, actually start to take seriously.
24:01
And I think if you look at some of the conference's, a lot more
24:05
kind of traditional security people are showing up to the
24:07
conferences and a lot more have more questions to their identity
24:09
people. So they're waking up and
24:13
wondering. How do I get the identity?
24:16
You know the data from the identity side so I'll give you
24:19
like an example. If there's an attack and they
24:24
realized that that certain files were accessed the way that
24:29
they're going to be able to understand.
24:31
You know what happened there. It's not just going to be by
24:34
looking Network logs it's going to be what did this identity
24:37
have access to? So I know that they had access
24:40
to this one file. What else do they have access
24:43
to? And that's, that's like you some
24:45
questions. We hear from a lot of security
24:46
people. And yeah, I think 2022 is was
24:50
the year that they realize they have to stamp start seeing these
24:52
capabilities up and identity as part of that stock.
24:56
Now, You brought up a couple points there that that I find
25:00
interesting. I think you described early on
25:03
the types of attacks right nation-state actors and sort of
25:07
these very targeted attacks which is certainly one style.
25:12
Then you have got the I do I call them you know targets of
25:15
opportunity which is really weird the ransomware kind of
25:18
comes in. It's not a smart Weapon It's
25:20
just hey who's going to click on this thing?
25:21
And let me get into their system and all right.
25:23
Get money on them and I think that's what causes two.
25:27
Current styles of prevention and mitigation and sort of awareness
25:31
around it is if if you are the target of a nation state actor,
25:36
you they're going to try to figure out you are the target.
25:40
Like they are going to do everything they can to get into
25:43
your system and odds are eventually, they will find a
25:47
weakness somewhere and get in which is a totally different
25:50
mitigation response versus a general ransomware attack, where
25:56
it is, you know, kind of Spray and pray or shotgun style or,
26:00
you know, whatever it may be, where they're, you know, you
26:03
have some, some mitigations you can do about it is probably
26:06
little bit easier. I would think to try to defend
26:09
against because it is the human element.
26:11
Don't click on things, you shouldn't click on, you know,
26:14
watch the URLs, watch for the spam attacks, right?
26:17
Things like that fishing fishing, right?
26:19
All that stuff, but they're still certainly a limit to what
26:23
can be real. You know, what can be effective
26:26
from a mitigation And point. So I think you've got these two
26:29
different styles of attacks and I guess, you know, obviously
26:32
identity is important to both, but where do you see things
26:37
going? I mean, I don't see either of
26:39
them going away, but are we just becoming more jaded to?
26:43
Yeah, of course, there's hacking.
26:44
Everyone's hacking each other. So what are we going to do about
26:47
it? Or are there specific things
26:49
that you see as a point to as a trend to say, you know, I'm
26:52
seeing more of this maybe in our own, you know, research or the
26:55
things that the awesome eyes. Join together.
26:58
So there's like a ton of stuff there.
26:59
So, where do I see things going? Start with.
27:02
I think I see things going to attackers focusing more actually
27:07
on the identity systems and any management providers and other
27:12
identity infrastructure. The past, you know, lapses
27:17
itself. When after a very well-known
27:20
identity provider and the was also recently targeted And had
27:27
their source code stolen. I think that you know you're
27:33
seeing more and more attacks going after the infrastructure
27:37
because they realize that if they're able to pop the
27:39
infrastructure they can hit everything else is Downstream
27:42
from there. So I think, you know, in the
27:44
same way that you know, solarwinds was was targeted
27:47
because it was a perfect supply chain spots.
27:51
It's a breach. You're going to start to see
27:53
that happening. Also more through the identities
27:56
Space. I have I agree and disagree with
27:59
what you're saying before. I think, of course we're jaded.
28:03
I'm not that security. If you're not Jaden security
28:05
gonna burn out, we all real fast.
28:10
I think that you can when you look in state actors versus
28:16
criminal or you know, just general malicious, it's some
28:20
dudes job to show up every day from 9:00 to 5:00 and try and
28:24
hack their target. They don't care about Oh, I like
28:27
that's that's their job, you know, and they'll keep going
28:32
till they hit something but it doesn't necessarily mean that
28:38
they're going to achieve all their goals and I think that you
28:41
know, if we're assuming breach which is kind of how we deal
28:45
with, you know, and the post post post post post mortem of
28:48
the you know of the perimeter being dead.
28:52
I think that we have to assume that somebody's already, you
28:55
know, if you're interesting enough To them.
28:56
They already have something inside of you inside of, you
28:59
know, whatever perimeter because there is still a perimeter but
29:02
it's just it's changed from get to that later.
29:07
The question is, how are you mitigating?
29:09
How are you keeping them away from kind of the really
29:11
important things? So I don't think it's a binary,
29:16
you know, they're a nation state actor.
29:17
So therefore, I'm gonna get popped.
29:20
I think that we can be a little more optimistic than that.
29:24
I think though that when you talking about the criminal
29:27
groups, what's the problem with that?
29:29
I mean there's only X number of X nation state.
29:32
Actors who have good, hack and resources.
29:36
There's an exponential number of criminal Crews who think they
29:40
can make a quick buck. So I think that the more were
29:44
able to frustrate them by, you know, maybe getting rid of
29:48
passwords may be doing other things that are just kind of low
29:51
hanging fruits to make their jobs harder.
29:54
The more we can maybe encourage them to go look elsewhere.
29:58
When it comes to, you know, Finding Target because criminals
30:03
do care about Roi. They don't care about how they
30:07
get to you, or how they make money.
30:08
They just want to make money so I gave them.
30:13
Yeah, I wanted to kind of well first, I wanted to make a
30:17
comment because I think you did a real good job about, you know,
30:21
not pointing out. The victims, whether they are,
30:25
you know, vendors or not, picking on the victims naming
30:30
names, and things like that. Because to me, it's kind of
30:32
like, you know, a lot of these breaches that are happening,
30:39
there's a victim and then there's, you know, a group that
30:47
is hacking that my destroying their businesses or destroying
30:51
their brand and there's Real people that work there and
30:54
there's real victims of these crimes and I also think that a
31:00
lot of times when you just keep saying the names of the victims
31:04
over and over again, it almost is like becomes people start to
31:07
take out it's their fault, they didn't do a good job of securing
31:11
things. And a lot of times when you
31:13
dissect these hacks It's a lot of things almost everybody's
31:17
doing the relying on third parties, for you know, whether
31:21
it's customer support or whatever or if they were storing
31:26
credentials in the cloud. Okay.
31:29
Yo, can you really look at yourself in the mirror and say,
31:32
hey I don't do that, I would never be stupid enough to do
31:34
something like that. I've worked in enough large
31:37
companies where even the top technical Architects don't have
31:41
that visibility across the entire company.
31:45
And so I think it's a good practice for us and we followed
31:50
on the podcast here because you can go and find out who the
31:52
victims are over and over again, but not to name and shame them.
31:57
So I, you know, I just want to tip my hat to you on that.
32:00
They I noticed that you really work hard to avoid that.
32:04
The second thing that I wanted to say is, you know, going back
32:08
to the question about your blog is you know, really pointing out
32:12
2022 is kind of the year. Identity became the, the center
32:17
of the infosec world. And look, we have a podcast
32:21
called identity at the center, right?
32:23
So we've been thinking about this for longer than the three
32:27
and a half years that we've been doing this podcast.
32:31
However, I do think there's kind of a point where, you know, it's
32:38
like a Tipping Point and maybe 20 22, was the year of the
32:43
Tipping Point where it's like, Like enough.
32:45
People are now buying into this that is is now truth identity is
32:50
at the center of information security.
32:53
Wait hold on a second. Jim I'd like to I'm going to
32:54
make that sound bite. I'd any of the center is a
32:56
truth. There we go.
32:58
Cut it print it. Sorry.
33:00
Good ready sure it's ready for publication Billboards.
33:04
No I mean by on your first point by The Graces you know go us
33:10
when it comes to hacking it's just a matter of how bad is it
33:14
if The dive of RSS feed of come from breaches dotnet and it's
33:19
just a constant constant constant flow of, you know, this
33:22
hospital or that the University or this.
33:25
Somebody heard this. Like, I think some government
33:29
office at on La yesterday. Got the ransom, we're just, it's
33:33
a constant flow. So I mean, hacks happen and in
33:40
organizations. Especially the larger, they are
33:44
the worst, they handle things, you know?
33:46
I'm just even the most basic of security things like patch.
33:50
Everybody's always saying patch patch patch.
33:52
How often does something happened to cousin from somebody
33:54
didn't patch because it's hard, get doing things, a hundred
33:57
percent, right is just it's impossible at the end difficult
34:00
to impossible. So it's even if somebody didn't
34:05
do what they're supposed to nobody's doing what they're
34:08
supposed to. Well, yeah, I think the to the
34:11
next point that I wanted to bring up, I think this is point,
34:13
which is unless you're to unplug, there's really no way to
34:19
eliminate 100% the risk. You tackle the topic called
34:23
identity and access its risk, and this points back to the
34:26
conversation. Jeff and I were having earlier
34:28
around aiders these risks out there.
34:32
We understand them as I am practitioners, we need to boil
34:36
them up. To the people who make decisions
34:38
about Where the money goes but we have to explain to them the
34:43
risk. To me the risk is, you know, the
34:46
likelihood of an event and the impact of the event and there's
34:51
different ways to mitigate that. Usually they have a price tag
34:55
Associated through them and you have to choose we all make
34:59
choices in life, right? About what risks were going to
35:03
accept object? I ride a motorcycle.
35:05
That's risky. Ready to participate.
35:08
In fact, a lot of people You'll think I'm stupid.
35:11
Okay, but it's a risk. I choose to take righto.
35:14
In fact, I pay for that risk. A lot of money for that risk but
35:19
you get the point. So I'm wondering, you know, what
35:23
was that about for you? So from my perspective, what
35:26
people need to understand is that you with with no risk,
35:29
there's no reward every bit of access that you're granting is a
35:33
risk. And That's just part of doing
35:38
business. You know, if you're going to, if
35:39
you're going to open somebody up an email, open up, you give them
35:42
access to the resources. They need to do their job.
35:46
That's a more than acceptable risk.
35:48
You just have to be able to work into your threat model of.
35:51
Is this, you know, juice worth the squeeze. and I think that,
35:59
Organizations are starting to really understand that identity.
36:03
Again, comes back to the to the to the Billboards.
36:05
We need to put start putting out is at the center of, how do you
36:09
provision access? Its that key, it's no longer.
36:14
Am I at the office? It's no longer.
36:16
You know what endpoint in my login on to, it's about who you
36:20
know, who am I? And all acts as kind of revolves
36:24
around that. So if you're not basing your
36:29
Risk assessments around identity and access.
36:33
Then what are you basing? It on now, I mean, it's just
36:36
kind of so so essential to I kind of feel like again kind of
36:41
I feel pretty strongly that executives are the ones who are
36:46
there. Some group that makes its
36:48
decision around? What we're going to invest in if
36:52
they don't understand the risk. Other words, the likelihood the
36:58
impact. But you know, they everything
37:00
that leads up to it, then it just becomes another acronym, we
37:04
need ite Dr. And it's going to be a million and a half.
37:08
Like, okay, that's too much. Well, that might be exactly what
37:13
they need to cut their risk. But unless they understand what,
37:18
I, what I get for that. And they also have to realize
37:21
that that's not a insurance policy.
37:25
In other words, like, We do end up getting hacked.
37:27
We get all of our money back like there's right.
37:30
It's not a guarantee. So, anyway, that that's my
37:33
thought on it as a risk. I did want to touch on one other
37:37
thing that you had in the blog. Which is, you know you talk
37:41
about identity is the new security perimeter.
37:44
To me, the sounds like zero trois.
37:47
I wonder, should we say zero trust By Any Other Name.
37:51
Is this Gabe's spin on zero? Trust What is that?
37:56
What you're talking about here essentially is like the whole
37:59
zero trust piece. Yes, short answer.
38:04
Yes. I think that, you know, to go
38:08
back to what I said before. When you assume reach, you
38:11
assume that, you know, whoever is trying to attack, you is
38:15
already inside, you know, that there's no more castles and mode
38:19
stands and big walls. We live in modern cities inside
38:25
of me. Turn City.
38:26
You know that there's no more Good Guys inside bad guys
38:29
outside. You have to understand who every
38:33
person is that your you have inside your city as much as you
38:37
can and, and live with that risk.
38:42
So zero trust. I mean again an overused
38:45
marketing term at this point but it's still a good idea, you
38:49
know, the concepts like least privilege.
38:52
I mean they're good ideas. Yeah, that's the unfortunate
38:55
part. Is that it's kind of been like,
38:57
oh, that's just a marketing term low.
39:00
So it's probably one of the most important fundamental concepts
39:04
that have saved information security in the past 10-15
39:08
years, you know? Well it's a it's a great concept
39:10
like it. It makes sense but it's like
39:13
anything else, right? It gets.
39:14
Obfuscated in overused by everything, right?
39:17
Everything is zero trust. Now.
39:18
Really come on. Well, yeah, I mean it's It's a
39:25
problem because as soon as one person, you know, what was the
39:28
c-suite starts understand? This is what it's you know is
39:33
something I need it soon. As you have you know executive
39:36
orders from the web, the White House saying you need to take a
39:38
zero just to you know architecture approach.
39:41
Then everything's going to comes here at rest.
39:44
But what I like about zero trust is it's it's an acceptance of
39:50
risk. It's acceptance of, I have these
39:54
risks in my environment, my environments.
39:58
So, any ideas that I have of, you know, everything has to be
40:02
100% safe. Everything's given to be 100%
40:04
anything. Go out the window, it's all
40:07
about. How do I mitigate risk, how do I
40:10
let my people continue to operate and then me as a
40:16
security team, Put all the efforts that we can and place at
40:20
the end of their possible to minimize that risk.
40:23
And and that means, you know, doing a lot of dynamic analysis,
40:28
kind of activity, from behind the scenes, trying to lower
40:33
friction as much as possible with through a lot of
40:35
Technologies. But also I think that there's a
40:37
cultural aspect of getting people used to the idea of,
40:40
okay? I'm going to have to, you know,
40:42
take my phone to do a facial recognition, like a facial Faith
40:46
ID in order to To get into my my password manager or it's new,
40:51
its authenticate into to Microsoft or whatever it is, you
40:54
know. I think that all those things
40:57
are part of creating a more secure culture, you know, at the
41:02
at work but it's I don't want people to be so annoyed with,
41:07
you know, the marketing term that they forget.
41:09
You know that they throw the baby out with the bathwater.
41:11
I think that's a real good point.
41:12
Yeah. Like it is I think it sounds to
41:15
me like we're all big Believers in zero trust and I think there
41:17
are a lot of people. Rightly.
41:18
So I think it is. You're totally right on.
41:21
Their right. Is, the term has been overused
41:23
and it has been applied to every single product out there in the
41:26
security space to jump on top of it.
41:29
But that doesn't mean that it's not a sound strategy.
41:32
Well, it's not a product, they're exactly.
41:34
And I think that front part that people, yeah, that's right.
41:37
Is there is no 10 trust product. It is a combination of several
41:41
security Concepts and strategies pulled together is very
41:46
effective when it is pulled. Together as a group, right?
41:49
For so I mean there's some vendor and I'll pick on a
41:51
vendor. Just anybody out there, right?
41:52
To say that, oh, we are the zero trust thing, okay, you're not
41:56
the thing, you're a thing in the zero, trust ecosystem, right?
42:01
Security is all about Stacks anyway, right?
42:03
It's the other layers, exactly. And and zero trust is, is, you
42:08
know, and whatever product you have are going to help you do
42:10
zero, trust better, you know, you can easier MFA, you need
42:14
your itd. Are you need all the Things that
42:18
you're going to help you do that but no one product is going to
42:20
do is going to be that. It's going to be about.
42:22
How does your organization actually implements those tools
42:24
and actually work with your Workforce to use it correctly?
42:29
Like how do you, how do you, how do you actually empowering
42:30
people to do security better? Yeah, I know.
42:34
We're in shorten the Scion time and I want to make sure I leave
42:36
enough time to ask a Brazilian jiu-jitsu question.
42:38
If I can, we're going to end on a lighter note.
42:41
And one of the things that we were talking about is we're sort
42:45
of getting prepped. As you mentioned, that you
42:47
study. Jujitsu and I'm not super
42:49
familiar with it. I took Taekwondo very long time
42:51
ago. I don't think Jim is taken any
42:53
martial arts other than maybe some sort of like word kung fu
42:57
for developing presentations or strategies things like that.
43:02
What is something? What is something that people
43:05
need to know about? Brazilian jiu-jitsu that you
43:08
don't think is well known. There's all kinds of good means
43:11
going around about about Brazilian jiu-jitsu at the the
43:16
gentle art of folding people's clothes.
43:17
As with that, but I'm still in it.
43:19
I love that play. Really?
43:21
Yeah, the the memes on BJJ go deep.
43:26
I think that the thing that I always like to tell people who
43:30
are getting to it and we actually have a couple guys on
43:31
the office to do it. And and also just in my group we
43:34
have a lot of security people to kind of a side note.
43:39
I think that the big thing is kind of embrace the suck and
43:43
embrace being bad at something for a long time.
43:47
Race. Somebody really just just
43:52
switching the hell out of you and and hurting you for a while
43:56
until you learn because at some point you're going to get
43:59
better. So I've been doing this now for
44:01
11 years or so before that I was a bad Thai boxer and before that
44:05
was a bad wrestler but you know it's like anything that you if
44:08
you get used to the idea of sometimes, you can have some
44:11
good days and some bad days you're going to have some days.
44:15
We just, you know, give you six months with Nothing goes right?
44:19
But eventually you learn and I think that that's kind of
44:23
something know about that and it's a good, you know, as a
44:26
parent as as other you know. It's a good way to a good way to
44:31
is to approach life something. I think that so if you if you
44:34
take that that idea and you go into Jiu-Jitsu with that
44:38
approach, you're gonna have a much better time and I'm going
44:42
to last longer. So I'm going to take take this
44:45
recording and I'm going to chop it up.
44:46
So that it says Says basically, you know, Gabe is saying use
44:49
Brazilian jiu-jitsu as a parent on your kids.
44:52
So I do I do and my, my young child loves to give me an arm
45:00
bar as and hates it when I give him.
45:02
He'll hooks. So you know, it's It's hard to
45:08
do, it wasn't like holiday tradition, armbars and heel
45:12
hooks all around the around the Festivus Pole or something.
45:15
Well, I can't use too small to actually get a proper heel hook
45:18
on it. So it's I'm working on it.
45:22
A friend of mine came up with jiu-jitsu for on babies.
45:25
Okay. You know, it's especially when
45:27
you're changing diapers to go to control the hips very important.
45:32
I think that's gonna be a whole library of other episode.
45:34
It will need to get into it. I know right time Jim.
45:36
What are your thoughts on? On Brazilian jiu-jitsu or BJJ
45:40
something, you know, you taking risks, man, you ride a
45:42
motorcycle. Yeah, I do.
45:44
I do bad boy. What what, what what kind of
45:47
motorcycle, it's a Kawasaki Falcon.
45:52
Okay. Yeah, it's not super expensive
45:55
but I did make it sound. Like I spend a lot of money on
45:58
it, but I spend some money on it Insurance.
46:02
Exactly. And getting not actually as good
46:04
on gas to. Yeah, as far, Is BJ.
46:08
I don't have any tips for anybody because they've done it.
46:13
Never done any martial arts but I've watched a lot of Bruce Lee,
46:17
you know, Kung Fu movies and I would say that my tip from
46:22
watching those movies is you don't have to speak perfect
46:26
English to speak, perfect. English, you know, your mouth
46:30
just moves and then the words come out and they are crystal
46:34
clear, kind of like a podcast. All right, let's go ahead and
46:39
leave it there for this week. Gave thank you so much for being
46:42
with us on the show. Today, I'm going to have a link
46:44
pleasure, LinkedIn profile on our show notes along with the
46:48
article and the awesome eyes. So people could learn more about
46:50
what you guys do over there. So feel free to connect with
46:54
Gabe. If you've got questions, agree
46:55
disagree. I'm sure he's happy to engage.
46:57
I'll just throw you out to the will always like that.
46:59
Always, always bring it. Bring it.
47:00
Bring it. So we'll go ahead and leave it
47:02
there for this week. You can follow us on the web
47:05
where at idac podcast.com. Mom, we're on Twitter at.
47:09
Idac podcast, we started a mastodon account over, the
47:13
winter break at idac podcast at infosec exchange which is a
47:18
total mouthful we did is we did a bitly link for that.
47:21
Yeah. No kidding, right.
47:23
That is be like better somehow. I'm not sure how though.
47:26
But anyway, we're going to go ahead and leave it there for
47:28
this week. Thanks everyone for listening
47:31
and we'll talk with everyone in the next one.
47:38
Thanks for listening to the identity at the center podcast.
47:41
If you like what you heard, don't forget to subscribe and
47:43
visit us on the web and identity at the center.com.